Skip to content

Align the .NET servicing train to 10.0.10/9.0.18 and hand-manage the Microsoft.OpenApi pin #355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Vulthil merged 2 commits into from
Jul 23, 2026
+28 −21
Merged

Align the .NET servicing train to 10.0.10/9.0.18 and hand-manage the Microsoft.OpenApi pin #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a8e8f1d
build(deps): align framework packages to 10.0.10/9.0.18 and hand-mana…
Vulthil Jul 22, 2026
246d592
build(deps): document the Aspire 13 floor that keeps Microsoft.Extens…
Vulthil Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,13 @@ updates:
interval: "daily"
open-pull-requests-limit: 25
ignore:
# Microsoft.OpenApi 3.x is a separate major that ASP.NET Core's Microsoft.AspNetCore.OpenApi does
# not consume; the explicit 2.x pin in Directory.Packages.props tracks the patched line for
# GHSA-v5pm-xwqc-g5wc. Allow 2.x patch/minor bumps; drop this rule together with that pin once
# Microsoft.AspNetCore.OpenApi's own dependency floor passes 2.7.5.
# Microsoft.OpenApi is pinned per-TFM in Directory.Packages.props (2.x patched line for net10.0
# per GHSA-v5pm-xwqc-g5wc; 1.6.17 for net9.0, matching Microsoft.AspNetCore.OpenApi 9.x's own
# floor — ASP.NET Core 9 does not consume the 2.x line). Dependabot flattens conditional MSBuild
# property definitions to a single value, which would force 2.x onto the net9.0 leg, so the pin
# is hand-managed and ALL updates are ignored here; NuGetAudit still fails CI on advisories.
# Drop this rule together with the pin once Microsoft.AspNetCore.OpenApi's floor passes 2.7.5.
- dependency-name: "Microsoft.OpenApi"
update-types: ["version-update:semver-major"]
groups:
xunit:
patterns:
Expand Down
38 changes: 22 additions & 16 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,15 @@
<CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
</PropertyGroup>
<PropertyGroup>
<FrameworkVersion>10.0.9</FrameworkVersion>
<FrameworkVersion Condition="'$(TargetFramework)' == 'net9.0'">9.0.17</FrameworkVersion>
<FrameworkVersion>10.0.10</FrameworkVersion>
<FrameworkVersion Condition="'$(TargetFramework)' == 'net9.0'">9.0.18</FrameworkVersion>
<AspireVersion>13.4.6</AspireVersion>
<!-- GHSA-v5pm-xwqc-g5wc: Microsoft.AspNetCore.OpenApi 10.0.9 (net10.0) pulls in the vulnerable
Microsoft.OpenApi 2.0.0. net9.0's Microsoft.AspNetCore.OpenApi 9.0.17 already depends on the
unaffected 1.x line, so only override the net10.0 leg; remove once AspNetCore.OpenApi bumps its own
floor past 2.7.5. -->
<MicrosoftOpenApiVersion>2.9.0</MicrosoftOpenApiVersion>
<!-- GHSA-v5pm-xwqc-g5wc: Microsoft.AspNetCore.OpenApi 10.0.10 (net10.0) still floors at the vulnerable
Microsoft.OpenApi 2.0.0. net9.0's Microsoft.AspNetCore.OpenApi 9.0.18 floors at the unaffected
1.6.17, so only override the net10.0 leg; remove once AspNetCore.OpenApi bumps its own floor past
2.7.5. Hand-managed: dependabot ignores Microsoft.OpenApi entirely because it flattens these
conditional legs to one value, forcing 2.x onto net9.0 (see .github/dependabot.yml). -->
<MicrosoftOpenApiVersion>2.11.0</MicrosoftOpenApiVersion>
<MicrosoftOpenApiVersion Condition="'$(TargetFramework)' == 'net9.0'">1.6.17</MicrosoftOpenApiVersion>
</PropertyGroup>
<ItemGroup>
Expand All @@ -33,18 +34,23 @@
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="$(FrameworkVersion)" />
<!-- MySQL: Aspire/Pomelo integration on net9; the Microting fork (a Pomelo fork) fills the EF Core 10 / net10 gap until the official Pomelo/Aspire packages ship it. -->
<PackageVersion Include="Aspire.Pomelo.EntityFrameworkCore.MySql" Version="$(AspireVersion)" />
<PackageVersion Include="Microting.EntityFrameworkCore.MySql" Version="10.0.9" />
<PackageVersion Include="Microting.EntityFrameworkCore.MySql" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Cosmos" Version="$(FrameworkVersion)" />
<PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.6.0" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.9" />
<!-- The in-box Microsoft.Extensions.* packages are deliberately literal, NOT $(FrameworkVersion):
the Aspire 13.x client integrations shipped in src (Aspire.RabbitMQ.Client and the three EF
provider integrations) floor them at >= 10.0.8 on BOTH TFMs, so a 9.x net9.0 leg is an NU1605
downgrade error. Http.Resilience and ServiceDiscovery version on their own out-of-band minor
cadence. -->
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.7.0" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.7.0" />
<PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.8.0" />
<!-- Scoped to the Aspire DCP integration-test project only (via eng/coverage.ps1's
Expand Down